Use the following best practices to make reports run faster:
Ø Whenever possible, search on indexed fields when creating reports. Indexed fields
are date and time, message ID, and device IP address. These fields are already
summarized in the database and using them speeds up report generation. Using
non-indexed fields adds significant time to report generation.
Ø Speed up processing by selecting Enable preprocess filters on the Select
Additional Report Options window. This option pushes data query out to the data
warehouse rather than bringing all the data into enVision for local processing,
which is time-consuming.
Ø If possible, do not select Use DNS Resolution (resolving addresses to host names)
on the Select Additional Report Options window as this process adds significant
time to report generation.
Ø Use device groups to improve report performance. Device groups limit reports to
only relevant event sources, minimizing the time needed to retrieve data.
Regards,
blackhat
No comments:
Post a Comment